Moving offices, left to me to reconfigure network

visibleman · 29 May 2011 at 17:48

Hopefully this is in the right forum; but long story short, we're moving offices and as the previous IT company got given the boot (mixture of stupidly expensive vs. them bodging/not really doing a lot) and with me (software dev) being the only one in the office that knows anything IT, I’ve been punted into the seat of reconfiguring the network :eek:

The current network/server situ looks like this -

It's a fairly straight forward setup, granted it currently has issues regarding redundancy/fall over situations, but personally I think it's a bit of a backwards setup created by the IT company with the SBS box (white box server, chugs a bit, could do with replacing at some point) having all those roles, DNS/DHCP (I know SBS likes to be the DHCP/DNS provider), yet not in a dual NIC setup ie: WWW -> Router/Firewall -> SBS -> Switch -> Client machines (eg: something like >this<).
I'm also not hugely convinced with the Cisco router as it has dropped connection a few times (very iffy in our current office), so I’m thinking of replacing that. Obviously wireless is dealt with by the Cisco and the SBS box deals with VPN, which I’ve been told is a bit of a no-no and should be handled by hardware where possible.

Before the questions, requirements - must have wireless access for business phones (and the odd laptop) although this isn't critical like the wired network; must have VPN access for remote access aka for when the MD goes on holiday and needs access to software/DBs; small business setup/no more than 5/6 client machines tops and as usual I have little to no budget to do anything with.

From what I’ve been told, the office building/complex (multiple businesses under one roof) has redundancies in place for power and internet; so that side of things should be taken care of.

Questions -

1) Regarding router/firewall replacement; I was thinking of either the Juniper SSG5 or SRX100 as I know a few people on here rave about them for small business installs (as well as Enterprise). Has anyone had experience setting up either using ScreenOS or Juno OS? Heard Juno OS is a bit of a mare of a learning curve compared to Screen OS although Juno is a lot more powerful. Otherwise something Dray Tek, like the 3300V+, although I’ve heard of a few people having serious issues with them and support is apparently dire. Anything Cisco is well out of budget.

2) Would I be better off leaving the network in the same configuration or moving the SBS box to a dual NIC setup? If it's dual NIC'd how would that effect VPN access, would it be better to give the router/firewall that role or leave the SBS box to deal with it?

3) I know you can get the SSG5 in a wireless version but that's over a £100 more than the standard SSG5; am I right i thinking I could just slap on a WAP (looking at a £20 TP-Link) to whatever router/firewall we get? In either the current configuration or a dual NIC SBS configuration, where is it best to place the WAP; off the router/firewall or the switch?

4) Another idea was to replace the server with a new SBS box (been looking at the HP Microserver), new Gb switch, remove the router/firewall completely and get SBS to do everything - wise idea or a bit silly and I SHOULD have a hardware firewall solution before the server? I have a feeling I already know this one

5) Anything else I’ve missed, should consider, over looked etc etc?

There is also an ongoing discussion regarding emails and whether or not we need an Exchange setup for so few people, but it is a mixture of what they've always used and me not finding a suitable hosted Exchange solution that meets our requirements with our budget and Google Apps is well out of the question as the MD thought it was "naff".

Cheers for any help :wave:

Skidilliplop · 30 May 2011 at 01:43

The original Design looks best physically.

I wouldn't want to pump everything through the server. Nor would I want SBS to be WAN facing without a firewall infront of it.

Redundancy wise it's such a small setup any real redundancy isn't going to be cost effective.
Perhapse stick a second NIC in the server (or if it's old buy a new one with dual NICs) and have them failover teamed. This wont affect IP settings at all and things such as VPN will be unaffected as long as you configure the IP settings on the team exactly the same as they were on the original NIC.

I'd probably buy a small gigabit smart switch, cos there's no reason not to and a move is the perfect time to do hardware refresh as downtime is unavoidable.

In terms of network redundancy your best bet would probably to have a spare switch (i.e the old one) on hand incase it fails.

Lastly, if you're not confident enough to take this task on without consulting a community forum, for the love of God get some sort of support contract! It makes me cringe when I hear of businesses binning their support contracts then not replacing them. It's cheaper now, but when something breaks you'll find yourselves losing a LOT of money and probably having to get outsourced IT in to rectify it anyway. At considerable cost.

Zarf · 30 May 2011 at 01:57

What is the budget? What are the specs of the SBS curently? Microservers aren't especially quick (I'm running Server 2008 and Solaris quite happily side by side on mine with ESXi at home, but it's not a very high workload)

Don't be put off Cisco by the Linksys tat, their business stuff is much better. I'm running a Cisco 877 for my home DSL, which helped with my CCNA. Very capable little machine that goes for around £100 on the bay. That'll do your routing, VPNs and firewalling. 877 has an adsl interface but you can just use Vlans to divide up the four Ethernet ports and put your external APs and cable modem on different subnets.

Should be more than enough for 5-6 clients on a 20Mb connection. Just get a Wireless N router or two to use as your access points (£10-£20 each)

A Smart switch isn't a bad idea either if you need to replace for gigabit anyway, gives you flexibility with vlans and teaming/failover. Probably cost around £100 for ~8 ports.

Skidilliplop · 30 May 2011 at 02:24

Zarf said:
What is the budget? What are the specs of the SBS curently? Microservers aren't especially quick (I'm running Server 2008 and Solaris quite happily side by side on mine with ESXi at home, but it's not a very high workload)

Don't be put off Cisco by the Linksys tat, their business stuff is much better. I'm running a Cisco 877 for my home DSL, which helped with my CCNA. Very capable little machine that goes for around £100 on the bay. That'll do your routing, VPNs and firewalling. 877 has an adsl interface but you can just use Vlans to divide up the four Ethernet ports and put your external APs and cable modem on different subnets.

Should be more than enough for 5-6 clients on a 20Mb connection. Just get a Wireless N router or two to use as your access points (£10-£20 each)

A Smart switch isn't a bad idea either if you need to replace for gigabit anyway, gives you flexibility with vlans and teaming/failover. Probably cost around £100 for ~8 ports.

I'd normally agree with this but there's a couple of oversights there.
Setting up a Cisco router to do all of those roles is a daunting task for a novice. Something with a bit more human friendly web based config interface might be more appropriate. Also depending on the number and throughput of the VPN tunnels there may be some value in terminating them behind the router. Cisco IOS tends to cause a massive drop in throughput once you start making it do VPNs and ACLs/ IPS. To get 20Mbit throughput on VPN tunnels you'd need to be looking more towards an 1800 series. If you can offload this work to something else you not only might speed things up but you'll not be tied down to a single point of failure. Which is an issue as the OP has already mentioned redundancy concerns.

Zarf · 30 May 2011 at 18:11

Skidilliplop said:
I'd normally agree with this but there's a couple of oversights there.
Setting up a Cisco router to do all of those roles is a daunting task for a novice. Something with a bit more human friendly web based config interface might be more appropriate. Also depending on the number and throughput of the VPN tunnels there may be some value in terminating them behind the router. Cisco IOS tends to cause a massive drop in throughput once you start making it do VPNs and ACLs/ IPS. To get 20Mbit throughput on VPN tunnels you'd need to be looking more towards an 1800 series. If you can offload this work to something else you not only might speed things up but you'll not be tied down to a single point of failure. Which is an issue as the OP has already mentioned redundancy concerns.

I figured as a software dev he's fairly technically competent, there are loads of config files around and a technical eye can work out what's going on by looking at them. The 877 does have a web interface as well.
I also figured that as the VPN is just a Virgin setup, it's not going to have more than 2Mb upload and as such they aren't likely to be putting much traffic over it.

But yeah, offloading the VPN work is preferable.

visibleman · 1 Jun 2011 at 10:57

Cheers for the help/advice. After a meeting yesterday it looks like this is getting pushed back until after we're in the office due to funding issues

Zarf - It's an AMD 64 2GHz (I think) 2GB white box, it chugs but seems to be coping ok. Ordered more ram (another 2GB) for it yesterday, hopefully that'll improve things for a while.

Briefly dabbled with Cisco gear in the past, but I’m leaning more towards a Juniper SSG 5 as the GUI interface is pretty straight forward and could be managed by the MD if need be (useful if I leave etc).

Regarding smart switch, was looking at the HP V1810-8G - this a good shout?

Cheers again all :cool:

Skidilliplop · 1 Jun 2011 at 11:04

1810 is a decent enough switch, though I would definitely go for more than 8 ports. 16-24 ports is a pretty good price/port balance and will solve expansion issues. 8 will be tight as with a standalone AP for wireless you'll be using 7 of the 8 ports at the outset, 8 if you go with redundant NICs on the server.